North Korean hackers are getting better at making stolen crypto vanish into thin air. The latest proof? A whopping $1.4 billion worth of Ethereum stolen from Bybit in February 2025 is slowly disappearing through mixing services, with Wasabi Mixer leading the pack in laundering operations.
The numbers tell a scary story. Nearly 28% of the stolen funds have become completely untraceable, according to Bybit CEO Ben Zhou. That’s roughly $400 million – poof, gone. The hackers aren’t exactly being subtle about it either. They’ve run 944 BTC (worth over $90 million) through Wasabi Mixer alone, before scattering the funds across other privacy platforms like CryptoMixer and Tornado Cash.
Nearly $400 million in stolen crypto has vanished without a trace, as hackers brazenly launder funds through mixing services.
The thieves got creative with their blockchain hopscotch. They converted most of the stolen ETH to Bitcoin using Thorchain, then fragmented it across a mind-boggling 35,772 wallets. Each wallet got a measly 0.28 BTC – talk about spreading your stolen goods thin. The hackers clearly did their homework on how to make funds disappear. Bybit’s reputation took a massive hit as their market share plunged to 5% from a previous high of nearly 20%.
Only about 3.84% of the stolen crypto (around $54 million) has been frozen by authorities. Meanwhile, the hackers are busy cashing out through peer-to-peer exchanges and over-the-counter trading platforms. Good luck tracking those down. Bybit has launched their Lazarus Bounty program with up to $140 million in rewards for information leading to fund recovery.
The digital fingerprints all point to North Korea’s infamous Lazarus Group. These aren’t your average crypto bros making rookie mistakes. They’ve engineered a sophisticated laundering operation that’s giving blockchain forensics teams major headaches.
The untraceable portion of funds jumped from 7.59% in March to 27.6% in April – a reminder that time isn’t on law enforcement’s side. While about $960 million remains traceable, that number shrinks by the day as the hackers continue their mixing spree. It’s like watching a magic trick in slow motion, except nobody’s clapping and Bybit’s definitely not volunteering for the next act.
